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Abstract 

This  report  discusses  the  acquisition  management  of  the  Joint  Personnel  Adjudication  System  by  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence)  and  the  Air  Force 
Security  and  Communication  Management  Directorate.  This  report  is  one  of  a  series  of  audit  reports 
addressing  personnel  security  clearance  and  access  issues.  The  Joint  Personnel  Adjudication  System  will 
provide  DoD  with  a  common  information  resource  for  granting  and  sharing  personnel  security  eligibility 
determinations  and  recording  personnel  access  to  sensitive  and  non-sensitive  compartmented  information. 
Its  common  database,  linked  by  the  Joint  Adjudication  Management  System  and  the  Joint  Clearance  and 
Access  Verification  System  applications,  will  standardize  security  clearance  adjudications  and 
verifications  in  compliance  with  DoD  Regulation  5200.2-R,  "Personnel  Security  Program  Regulation, Is 
January  1,  1987."  DoD,  Military  Departments,  and  DoD  Components  funded  the  Joint  Personnel 
Adjudication  System  information  technology  investment.  Through  the  fourth  quarter  of  FY 1999,  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence)  provided  the  Air 
Force  with  $8  million  for  Joint  Personnel  Adjudication  System  development  and  purchases  of  hardware 
and  software.  Since  the  start  of  FY  2000,  the  Military  Departments  and  DoD  Components  financed  the 
Joint  Personnel  Adjudication  System  by  transferring  Operations  and  Maintenance  funds  to  the  Air  Force. 
For  FY  2001  through  FY  2007,  the  Air  Force  estimates  that  the  Joint  Personnel  Adjudication  System  costs 
assessed  to  the  Military  Departments  and  DoD  Components  will  amount  to  $34  million. 
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400  ARMY  NAVY  DRIVE 
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May  5,  2001 


MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND, 

CONTROL,  COMMUNICATIONS,  AND  INTELLIGENCE) 
ASSISTANT  SECRETARY  OF  THE  AIR  FORCE 

(FINANCIAL  MANAGEMENT  AND  COMPTROLLER) 


SUBJECT :  Audit  Report  on  Acquisition  Management  of  the  Joint  Personnel 
Adjudication  System  (Report  No.  D-2001-112) 


We  are  providing  this  report  for  review  and  comment.  We  considered 
management  comments  on  a  draft  of  this  report  in  preparing  the  final  report. 

DoD  Directive  7650.3  requires  that  all  unresolved  issues  be  resolved  promptly. 
The  Assistant  Security  of  Defense  (Command,  Control,  Communication,  and 
Intelligence)  concurred  with  the  audit  finding  and  recommendation.  With  respect  to 
moving  Joint  Personnel  Adjudication  System  funding  and  accountability  out  of  the  Air 
Force,  we  request  that  management  provide  additional  comments  by  June  4,  2001 
regarding  when  such  action  would  be  achievable. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Charles  M.  Santoni  at  (703)  604-9051 
(DSN  664-9051)  (csantoni@dodig.osd.mil)  or  Mr.  David  M.  Wyte  at  (703)  604-9027 
(DSN  664-9027)  (dwyte@dodig.osd.mil).  See  Appendix  D  for  the  report  distribution. 
The  audit  team  members  are  listed  inside  the  back  cover. 
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Thomas  F.  Gimble 
Acting 

Deputy  Assistant  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General,  DoD 


Report  No.  D-2001-112  May  5,  2001 

(Project  No.  D2001AL-0012) 

Acquisition  Management  of  the  Joint  Personnel  Adjudication  System 


Executive  Summary 


Introduction.  This  report  discusses  the  acquisition  management  of  the  Joint  Personnel 
Adjudication  System  by  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  and  the  Air  Force  Security  and  Communication 
Management  Directorate.  This  report  is  one  of  a  series  of  audit  reports  addressing 
personnel  security  clearance  and  access  issues. 

The  Joint  Personnel  Adjudication  System  will  provide  DoD  with  a  common  information 
resource  for  granting  and  sharing  personnel  security  eligibility  determinations  and 
recording  personnel  access  to  sensitive  and  non-sensitive  compartmented  information. 

Its  common  database,  linked  by  the  Joint  Adjudication  Management  System  and  the 
Joint  Clearance  and  Access  Verification  System  applications,  will  standardize  security 
clearance  adjudications  and  verifications  in  compliance  with  DoD  Regulation  5200. 2-R, 
“Personnel  Security  Program  Regulation,”  January  1,  1987. 

DoD,  Military  Departments,  and  DoD  Components  funded  the  Joint  Personnel 
Adjudication  System  information  technology  investment.  Through  the  fourth  quarter  of 
FY1999,  the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  provided  the  Air  Force  with  $8  million  for  Joint  Personnel  Adjudication 
System  development  and  purchases  of  hardware  and  software.  Since  the  start  of 
FY  2000,  the  Military  Departments  and  DoD  Components  financed  the  Joint  Personnel 
Adjudication  System  by  transferring  Operations  and  Maintenance  funds  to  the  Air 
Force.  For  FY  2001  through  FY  2007,  the  Air  Force  estimates  that  the  Joint  Personnel 
Adjudication  System  costs  assessed  to  the  Military  Departments  and  DoD  Components 
will  amount  to  $34  million. 

Objectives.  The  overall  audit  objective  was  to  evaluate  the  acquisition  management  of 
the  Joint  Personnel  Adjudication  System.  Specifically,  the  audit  determined  whether 
the  system  was  being  cost-effectively  acquired,  monitored,  tested,  and  prepared  for 
deployment  and  system  life-cycle  support  in  accordance  with  DoD  Directive  5000.1, 
“Defense  Acquisition,”  March  15,  1996  (subsequently  revised  on  October  23,  2000), 
and  DoD  Directive  5200.28,  “Security  Requirements  for  Automated  Information 
Systems  (AISs),”  March  21,  1988.  In  addition,  we  evaluated  the  management  control 
program  related  to  the  objective.  See  Appendix  A  for  a  discussion  of  the  audit  scope 
and  methodology  and  the  review  of  the  management  control  program. 

Results.  The  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  and  the  Air  Force  did  not  manage  the  Joint  Personnel  Adjudication  System 
as  an  information  technology  investment.  As  a  result,  acquisition  planning  for  the  Joint 
Personnel  Adjudication  System  did  not  extend  beyond  the  Future  Years  Defense  Plan; 
funding  for  the  system  acquisition  did  not  comply  with  DoD  Regulation  7000. 14-R, 
“Department  of  Defense  Financial  Management  Regulation,”  June  2000,  and  acquisition 


management  oversight  did  not  comply  with  the  intent  of  the  Clinger-Cohen  Act  of  1996. 
During  the  audit,  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  and  the  Air  Force  agreed  to  work  towards: 

•  implementing  a  project  plan  for  developing  life-cycle  acquisition  strategy  costs, 

•  performing  independent  cost  and  economic  analyses, 

•  transferring  program  funding  for  development  and  deployment  from  the 
Operations  and  Maintenance  appropriation  to  the  Research,  Development,  Test 
and  Evaluation  appropriation,  and 

•  transferring  program  funding  and  accounting  responsibilities  from  the  Air  Force. 

However,  despite  the  system’s  significance  in  support  of  DoD  missions,  action  had  not 
been  initiated  to  provide  a  prudent  level  of  acquisition  oversight.  See  the  Finding 
section  for  details  on  the  audit  results. 

Summary  of  Recommendations.  We  recommend  that  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  designate  the  Joint 
Personnel  Adjudication  System  as  a  Major  Information  Technology  Investment,  subject 
to  oversight  of  the  DoD  Chief  Information  Officer. 

Management  Comments.  The  Office  of  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  concurred  with  the  report 
finding  and  recommendation.  A  discussion  of  management  comments  is  in  the  Finding 
section  of  the  report,  and  the  complete  text  of  the  management  comments  is  in  the 
Management  Comments  section. 

Audit  Response.  The  Office  of  the  Assistant  Secretary  of  Defense  (Command, 

Control,  Communications,  and  Intelligence)  actions  with  respect  to  the  recommendation 
are  responsive.  With  respect  to  moving  Joint  Personnel  Adjudication  System  funding 
and  accountability  out  of  the  Air  Force,  we  request  that  management  provide  additional 
comments  by  June  4,  2001  regarding  when  such  action  would  be  achievable. 
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Background 


This  report  is  one  in  a  series  of  audit  reports  addressing  personnel  security 
clearance  and  access  issues.  Previous  Inspector  General,  DoD,  reports  addressed 
tracking  security  clearance  requests,  security  clearances  for  personnel  in  mission- 
critical  and  high  risk  positions,  feasibility  of  consolidating  adjudicative  facilities, 
the  lack  of  access  reciprocity  within  DoD  special  access  programs,  personnel 
resources  needed  at  the  DoD  adjudicative  facilities,  the  program  management  and 
acquisition  of  the  Case  Control  Management  System,  and  the  accuracy,  integrity, 
timeliness,  and  availability  of  information  in  the  Defense  Clearance  and 
Investigation  Index  Database. 

The  Joint  Personnel  Adjudication  System.  The  Joint  Personnel  Adjudication 
System  (JPAS)  will  provide  DoD  with  a  common  information  resource  for  granting 
and  sharing  personnel  security  eligibility  determinations  and  recording  personnel 
access  to  sensitive  and  non-sensitive  compartmented  information.  Its  common 
database,  linked  by  the  Joint  Adjudication  Management  System  (JAMS)  and  the 
Joint  Clearance  and  Access  Verification  System  (JCAVS)  applications,  will 
standardize  security  clearance  adjudications  in  compliance  with  DoD  Regulation 
5200. 2-R,  “Personnel  Security  Program  Regulation,”  January  1,  1987,  and  will 
provide  security  managers  with  eligibility  verifications  for  personnel  desiring  access 
to  sensitive  and  classified  facilities,  weapons  systems,  and  information.  Also,  JPAS 
will  provide  reports  for  programming  and  managing  workloads  at  the  DoD  central 
adjudication  facilities  and  locations  requiring  cleared  personnel.  See  Appendix  B 
for  a  list  of  the  DoD  central  adjudication  facilities. 

JAMS  and  JCAVS.  The  JAMS  and  JCAVS  applications  will  not  create  new  data 
from  stored  database  records.  However,  they  will  automatically  modify  information 
stored  in  the  JPAS  common  database.  The  JAMS  and  JCAVS  applications  extract 
information  from  the  JPAS  database  and  format  and  display  it  as  electronic  reports 
on  adjudicators’  and  security  managers’  desktop  monitors.  Because  the  common 
database  contains  records  affecting  personnel  privacy,  JPAS  is  defined  by  the 
Privacy  Act  (5  U.S.C  552a)  as  a  sensitive  but  unclassified  system. 

Processing.  JPAS  and  its  applications  will  not  measurably  expedite  processing 
clearance  eligibilities  and  access  to  sensitive  and  classified  assets.  Determinations 
affecting  personnel  trustworthiness  require  off-line  decisions  by  adjudicators  and 
security  managers.  However,  the  deployed  JAMS  with  its  electronic  reports  will 
relieve  the  central  adjudication  facilities  from  handling  paper  documents. 

According  to  a  JPAS  contractor-developed  economic  analysis,  paper  handling 
consumed  more  than  1  million  hours  over  a  6-year  period.  In  addition  to 
replacing  paper  documents  with  electronic  reports,  JPAS  will  allow  JAMS  users 
to  grant  clearance  eligibilities  from  determinations  made  by  other  adjudication 
facilities.  Adjudicators  can  obtain  and  review  JAMS  electronic  reports  supporting 
prior  eligibility  determinations  and  accept  decisions  without  initiating  personnel 
reinvestigations.  In  addition,  JPAS  minimizes  work  delays  for  newly  hired  and 
visiting  personnel  with  adjudicated  clearances.  Security  managers  connected  to 
JCAVS  can  grant  or  deny  personnel  access  to  sensitive  and  classified  resources 
from  database  information  placed  on  electronic  reports. 


1 


Hardware  Configuration.  JPAS  is  hosted  on  a  web-based  hardware,  common 
database  configuration.  The  primary  hardware  configuration  for  the  JPAS 
common  database  resides  at  Bolling  Air  Force  Base,  Washington,  D.C.,  with  a 
back-up  configuration  in  Monterey,  California.  The  system  is  sized  for  growth 
in  workload.  It  is  designed  to  accommodate  450  JAMS  and  30,000  JCAVS 
users,  assist  in  processing  750,000  adjudication  cases  annually,  maintain 
clearance  designations  for  5  million  people,  and  provide  statistical  data  and 
capabilities  to  conduct  personnel  security  studies. 

Oversight  and  Management.  The  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  [ASD(C3I)]  functionally  sponsors 
JPAS,  but  has  not  designated  JPAS  as  either  an  Acquisition  Category  IA1  or  a 
Major  Information  Technology  Investment2  information  system.  The  Assistant 
Secretary  assigned  program  management  responsibilities  to  the  Air  Force  for 
acquisition  and  operations  and  maintenance.  Contractors  provide  the  Air  Force 
services  for  development,  integration  and  deployment,  information  assurance, 
and  verification  and  validation. 

Funding.  DoD,  the  Military  Departments,  and  DoD  Components  funded  the 
JPAS  information  technology  investment.  Through  the  fourth  quarter  of 
FY  1999,  ASD(C3I)  provided  the  Air  Force  with  $8  million  for  JPAS 
development  and  purchases  of  hardware  and  software.  Since  the  start  of 
FY  2000,  the  Military  Departments  and  DoD  Components  financed  the  JPAS 
investment  with  Operations  and  Maintenance  funds  transferred  to  the  Air  Force. 
For  FY  2001  through  FY  2007,  the  Air  Force  estimates  that  JPAS  costs  assessed 
to  the  Military  Departments  and  DoD  Components  will  amount  to  $34  million. 

Testing  and  Deployment.  The  Air  Force  is  testing  and  deploying  JPAS.  Until 
the  JAMS  and  JCAS  applications  demonstrate  adequate  system  effectiveness  and 
reliability,  legacy  adjudication  systems  will  operate  in  parallel  with  the  deployed 
JPAS.  Initial  Operational  Capability  is  planned  for  October  2001. 


‘Programs  are  defined  as  Acquisition  Category  IA  automated  information  systems  if  costs  for  any  single  year 
exceed  $32  million  (FY  2000  constant  dollars),  total  program  costs  exceed  $126  million,  total  life-cycle 
costs  exceed  $378  million,  or  if  ASD(C3I)  designates  them  as  Acquisition  Category  IA  systems. 

2Programs  are  defined  as  Major  Information  Technology  Investment  if  ASD(C3I)  determines  that  a 
program  requires  special  Office  of  Secretary  of  Defense  management  attention  because  of  its  importance 
to  the  DoD  mission;  its  high  development,  operating,  or  maintenance  costs;  or  its  significant  role  in 
administering  DoD  programs,  finances,  property,  or  other  resources. 
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Objective 


The  overall  audit  objective  was  to  evaluate  the  acquisition  management  of  JPAS. 
Specifically,  the  audit  determined  whether  the  system  was  being  cost-effectively 
acquired,  monitored,  tested,  and  prepared  for  deployment  and  system  life-cycle 
support  in  accordance  with  DoD  Directive  5000.1,  “Defense  Acquisition,” 
March  15,  1996  (subsequently  revised  on  October  23,  2000),  and  DoD 
Directive  5200.28,  “Security  Requirements  for  Automated  information 
Systems  (AISs),”  March  21,  1988.  In  addition,  we  evaluated  the  management 
control  program  related  to  the  objective.  See  Appendix  A  for  a  discussion  of 
the  audit  scope  and  methodology  and  the  review  of  the  management  control 
program. 
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Acquisition  of  the  Joint  Personnel 
Adjudication  System  Information 
Technology  Investment 

The  ASD(C3I)  and  the  Air  Force  did  not  manage  the  JPAS  as  an 
information  technology  investment  because  the  acquisition  strategy  was 
not  redefined  to  reflect  the  change  made  to  the  system’s  architecture.  As 
a  result,  acquisition  planning  for  the  JPAS  technology  investment  did  not 
extend  beyond  the  Future  Years  Defense  Plan  and  handing  for  the  system 
acquisition  was  not  in  compliance  with  DoD  Regulation  7000. 14-R, 
“Department  of  Defense  Financial  Management  Regulation,”  June  2000. 
Also,  acquisition  management  oversight  was  not  provided  because  JPAS 
was  not  designated  for  special  management  attention,  despite  its 
criticality  in  support  of  DoD  missions.  During  the  audit,  ASD(C3I)  and 
the  Air  Force  agreed  to  work  towards: 

•  implementing  a  project  plan  for  developing  life-cycle  acquisition 
strategy  costs, 

•  performing  independent  cost  and  economic  analyses, 

•  transferring  program  funding  for  development  and  deployment  from 
the  Operations  and  Maintenance  appropriation  to  the  Research, 
Development,  Test  and  Evaluation  appropriation,  and 

•  transferring  program  funding  and  accounting  responsibilities  from  the 
Air  Force. 

Mandatory  Guidance 


The  Office  of  Management  and  Budget  and  DoD  provide  managers  with 
guidance  for  acquiring  information  technology  investments  and  safeguarding 
information.  Appendix  C  describes  the  guidance  as  it  relates  to  the  JPAS 
acquisition. 

Alternatives 


Decisionmakers  had  alternative  information  systems  and  hardware  architectures 
available  for  the  JPAS  business  solution.  More  than  one  information  system 
was  available  for  processing  and  verifying  security  eligibilities,  and  more  than 
one  database  architecture  alternative  was  available  for  storing  common 
information. 
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Air  Force  Sentinel  Key 


The  JPAS  Executive  Steering  Committee/Configuration  Management  Board3 
adapted  the  Air  Force  Sentinel  Key  database  system  as  a  model  for  the  JPAS 
clearance  eligibility  and  verification  business  solution.  Data  extracted  from  the 
Sentinel  Key  database  provided  Air  Force  adjudicators  with  sufficient 
information  to  comply  with  the  procedures  in  DoD  Regulation  5200. 2-R  for 
granting  or  denying  personnel  security  clearance  eligibilities.  In  addition,  Air 
Force  security  managers  used  the  Sentinel  Key  database  to  verify  clearance 
eligibilities  of  Air  Force  personnel  to  access  secured  facilities,  weapons 
systems,  and  classified  information.  Also,  lessons  learned  from  Sentinel  Key 
could  be  applied  to  JPAS  for  mitigating  risks,  organizing  integrated  product 
teams  for  determining  application  report  requirements,  and  preparing  documents 
for  fund  requests. 

Architectures 


Two  database  system  alternatives  were  available  for  storing  common 
information,  extracting  data,  formatting,  and  displaying  information  on  electronic 
reports.  Although  the  distributed  and  centralized  hardware  architectures 
differed,  the  differences  between  them  would  not  be  noticeable  to  the  user. 

Distributed  Architecture.  A  distributed  architecture  connects  users  to  a 
network  of  internal  and  external  databases.  Sites  determining  security 
eligibilities  operate  and  maintain  similar  hardware.  The  hardware,  when 
combined  with  inserted  software  applications  such  as  JAMS  and  JCAVS, 
provides  users  with  a  standardized  and  interoperable  information  technology 
system  for  processing  security  clearance  eligibilities  and  verifications.  Further, 
each  database  location  incurs  system  operations  and  maintenance  costs  for 
processing  security  eligibilities  and  verifications. 

Centralized  Architecture.  A  centralized  architecture  links  adjudication  and 
verification  processing  sites  to  a  single  database.  To  obtain  system  application 
reports  from  their  workstations,  users  access  the  single  database  through  a  web 
browser  and  a  non-secure  Internet  connection.  That  alternative  eliminates  the 
network  of  databases  and  the  need  for  installed  software  applications  at 
adjudication  processing  sites.  In  addition,  system  hardware  and  operations  and 
maintenance  costs  are  confined  to  one  location  rather  than  spread  among 
numerous  sites. 


3The  Director  of  Personnel  Security,  ASD(C3I),  and  the  heads  of  the  nine  DoD  Central  Adjudication 
Facilities  comprise  the  JPAS  Executive  Steering  Committee/Configuration  Management  Board. 
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Architecture  Change 


Initially,  JPAS  was  designed  as  a  network  of  distributed  databases.  However,  in 
August  1999,  the  JPAS  Executive  Steering  Committee/Configuration  Management 
Board  decided  to  change  the  system  architecture  to  a  centralized  database  to: 

•  reduce  the  risk  of  reoccurring  stovepipe  systems, 

•  provide  direct  data  standardization,  synchronization,  and  configuration 
control, 

•  eliminate  the  purchase  of  servers  and  additional  hardware  at  adjudication 
processing  sites, 

•  facilitate  the  interface  of  legacy  and  migration  systems,  and 

•  eliminate  up  to  $17  million  in  duplicative  software  licensing  and 
hardware  costs  over  a  6-year  period. 

However,  the  acquisition  strategy  for  JPAS  was  not  redefined  to  reflect  the 
architecture  change. 

Acquisition  Strategy 


The  ASD(C3I)  and  the  Air  Force  continued  to  manage  the  JPAS  as  a  network  of 
databases  populated  with  common  information.  As  a  result,  life-cycle  planning 
did  not  extend  beyond  the  Future  Years  Defense  Plan,  and  funding  for  the 
acquisition  did  not  comply  with  the  Under  Secretary  of  Defense  (Comptroller) 
memorandum,4  “Clarification  of  Policy-Budget  for  Information  Technology  and 
Automated  Information  Systems,”  October  26,  1999.  Also,  the  DoD  Chief 
Information  Officer  did  not  provide  acquisition  oversight  in  accordance  with 
Clinger-Cohen  Act  of  1996. 5  However,  during  the  audit,  the  ASD(C3I)  and  the 
Air  Force  agreed  to  extend  life-cycle  planning  beyond  the  Future  Years  Defense 
Plan  and  address  program  funding  issues. 

Life-Cycle  Planning.  Life-cycle  planning  for  JPAS  was  incomplete.  Life-cycle 
cradle  to  grave  cost  estimates  measure  returns  on  investments  and  provide 
baselines  for  evaluating  performance  and  progress.  Although  the  Air  Force  did 
prepare  JPAS  life-cycle  management  plans  and  economic  analyses,  the  documents 
did  not  comply  with  Office  of  Management  and  Budget  Circular  A- 130, 
“Management  of  Federal  Information  Resources,”  November  30,  2000  guidance. 
The  documents  did  not  extend  beyond  the  system’s  deployment  and  initial  years  of 
operation.  The  documents  supported  funding  for  the  Future  Years  Defense  Plan 
rather  than  justified  JPAS  as  a  life-cycle  information  technology  investment  with 
identifiable  development,  deployment,  and  operations  and  maintenance  phases. 


4The  DoD  Comptroller  policy  clarification  was  later  incorporated  into  DoD  Regulation  7000. 14-R, 
Volume  2A,  “Budget  Formulation  and  Presentation,”  June  2000. 

5Public  Law  104-106,  Division  E,  “National  Defense  Authorization  Act  for  Fiscal  Year  1996, 
(Information  Technology  Management  Reform),”  February  10,  1996. 
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Further,  performance  and  progress  measurements  could  not  be  made  because 
life-cycle  baselines  did  not  exist.  Absent  baselines  for  cost,  schedule,  and 
performance,  actual  versus  planned  variations  could  not  be  determined  and 
indices  for  projecting  results  could  not  be  computed. 

Funding.  Funding  for  JPAS  development  costs  did  not  comply  with  the 
October  1999  DoD  Comptroller  policy  clarification  for  funding  information 
technology  investments.  Prior  to  the  October  1999  policy  clarification, 
Operations  and  Maintenance  and  Procurement  appropriations  rather  than 
Research,  Development,  Test  and  Evaluation  appropriations  could  be  used  to 
fund  information  technology  systems  when  commercial-off-the-shelf  software 
was  obtained  or  modified  for  existing  systems.  Because  JPAS  was  defined  as  a 
commercial  off-the-shelf  system,  the  ASD(C3I)  and  the  Air  Force  financed 
JAMS  and  JCAVS  software  applications  for  JPAS  with  Operations  and 
Maintenance  appropriations  and  financed  system  hardware  costs  with 
Procurement  appropriations.  However,  subsequent  to  the  policy  clarification, 
the  ASD(C3I)  and  the  Air  Force  continued  to  fund  JPAS  with  Operations  and 
Maintenance  and  Procurement  appropriations. 

Further,  program  costs  were  charged  to  the  Air  Force  when  charges  could  not 
be  specifically  identified  to  JPAS  equipment  procurements  or  contracted 
development  and  maintenance  services.  Costs  for  the  JPAS  program  office 
direct  labor,  overhead,  and  other  support  costs  were  charged  to  the  Air  Force 
Central  Adjudication  Facility  instead  of  JPAS. 

Oversight.  The  DoD  Chief  Information  Officer  did  not  demonstrate  oversight 
involvement  in  the  acquisition  of  the  JPAS .  The  Clinger-Cohen  Act  requires 
Chief  Information  Officers  to  monitor  and  evaluate  the  performance  of 
information  technology  programs  and  advise  the  heads  of  agencies  whether  to 
continue,  modify,  or  terminate  a  program.  JPAS  supports  the  eligibility 
adjudication  and  verification  business  processes  for  granting  security  clearances 
to  military,  civilian,  and  contractor  personnel.  Accordingly,  any  processing 
delay  caused  by  JPAS  could  also  delay  DoD  and  contractor  personnel  from 
performing  assigned  functions.  As  a  result,  JPAS  requires  Chief  Information 
Officer  oversight  because  of  its  significance  in  supporting  DoD  missions. 

Management  Actions.  In  response  to  an  Inspector  General,  DoD,  status 
briefing  on  the  audit,  the  ASD(C3I)  and  the  Air  Force  agreed  to  work  towards: 

•  implementing  a  project  plan  for  developing  life-cycle  acquisition  strategy 
costs, 

•  performing  independent  cost  and  economic  analyses, 

•  transferring  program  funding  for  development  and  deployment  from  the 
Operations  and  Maintenance  appropriation  to  the  Research, 

Development,  Test  and  Evaluation  appropriation,  and 

•  transferring  program  funding  and  accounting  responsibilities  from  the 
Air  Force. 
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Information  Security  and  Integrity 


The  ASD(C3I)  and  the  Air  Force  were  completing  information  security 
requirements  for  certifying  and  accrediting  JPAS.  Further,  information  migrating 
to  the  centralized  database  was  being  reviewed  for  completeness  and  accuracy. 

Information  Security.  Information  security  was  being  evaluated  during  JPAS 
beta  testing.  Without  an  off-line  test  bed  capability  for  evaluating  system 
operational  suitability,  adjudication  facilities  and  security  managers  were 
processing  actual  cases  to  determine  JPAS  effectiveness,  reliability, 
maintainability,  and  information  security.  Testing  began  in  January  2001  after 
the  Air  Force  Designated  Approval  Authority  for  information  security  granted 
the  JPAS  program  office  an  Interim  Approval  To  Operate.  Almost  50  percent 
of  the  tests  had  been  completed. 

Information  Integrity.  The  ASD(C3I)  and  the  Air  Force  were  actively 
engaged  in  resolving  JPAS  data  discrepancies  to  ensure  system  accuracy  and 
reliability.  System  efficiency  and  effectiveness  depend  on  the  quality  of 
information  stored  in  the  JPAS  central  database.  Legacy  databases  maintained 
by  the  Component  adjudication  facilities  were  being  compared  with  information 
stored  at  the  Defense  Manpower  Data  Center  and  the  Defense  Civilian 
Personnel  Data  Center  to  identify  discrepancies.  When  discrepancies  were 
identified,  research  was  initiated  to  resolve  the  conflicts.  However,  the  inability 
to  extract  and  obtain  quality  data  from  the  legacy  systems  has  delayed  progress 
in  populating  the  JPAS  central  database.  As  a  result,  Initial  Operational 
Capability  could  be  extended  beyond  October  2001. 

Conclusion 


The  ASD(C3I)  and  the  Air  Force  did  not  manage  the  JPAS  as  an  information 
technology  investment  when  the  system  acquisition  strategy  changed  from  a 
network  of  distributed  database  systems  to  a  centralized  database  system.  As  a 
result,  acquisition  planning  for  the  JPAS  technology  investment  did  not  extend 
beyond  the  Future  Years  Defense  Plan,  and  funding  for  the  system  acquisition 
did  not  comply  with  DoD  Regulation  7000. 14-R.  Also,  despite  the  system’s 
criticality  in  support  of  DoD  missions,  acquisition  management  oversight  was 
not  provided  in  accordance  with  the  Clinger-Cohen  Act. 

Although  acquisition  management  of  JPAS  did  not  comply  with  Office  of 
Management  and  Budget  and  DoD  guidance,  the  ASD(C3I)  and  the  Air  Force 
had  applied  lessons  learned  from  the  acquisition  of  the  Air  Force  Sentinel  Key 
database  system,  organized  integrated  product  teams  for  determining  system 
requirements,  and  prepared  documents  for  funding  requests.  Also,  system  tests 
were  performed  to  determine  the  effectiveness  and  reliability  of  the  system’s 
information  security.  Further,  information  migrating  from  legacy  databases  was 
analyzed  for  integrity.  However,  due  to  the  inability  to  extract  and  obtain 
quality  data  from  the  legacy  systems,  delays  occurred  in  populating  the  JPAS 
central  database. 
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During  the  audit,  the  ASD(C3I)  and  the  Air  Force  agreed  to  work  towards 
extending  life-cycle  planning  beyond  the  Future  Years  Defense  Plan  and 
addressing  program  funding  issues.  However,  despite  the  system’s  significance  in 
support  of  DoD  missions,  action  had  not  been  initiated  to  provide  a  prudent  level 
of  acquisition  oversight. 

Recommendation  and  Management  Comments 


We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 

Control,  Communications,  and  Intelligence)  designate  the  Joint  Personnel 
Adjudication  System  as  a  Major  Information  Technology  Investment, 
subject  to  oversight  of  the  DoD  Chief  Information  Officer. 

Management  Comments.  The  Director  of  the  Security  Directorate,  Assistant 
Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence), 
concurred  and  stated  that  the  DoD  Chief  Information  Officer  will  be  the  Joint 
Personnel  Adjudication  System  milestone  decision  authority  and  will  provide 
oversight  of  the  program.  The  DoD  Chief  Information  Officer  will  monitor  the 
System’s  progress  using  the  quarterly  Defense  Acquisition  Executive  Summary 
reports  starting  with  the  fourth  quarter  of  FY  2001. 

Management  also  stated  that  while  it  initially  had  no  opposition  to  moving  Joint 
Personnel  Adjudication  System  funding  and  accounting  responsibilities  out  of 
the  Air  Force,  it  may  not  be  desirable  or  achievable  in  the  near  future  without 
adversely  impacting  progress  on  the  Joint  Personnel  Adjudication  System. 

Audit  Response.  Management  actions  with  respect  to  the  recommendation  are 
responsive.  With  respect  to  moving  Joint  Personnel  Adjudication  System 
funding  and  accountability  out  of  the  Air  Force,  we  request  additional  comments 
as  to  when  such  action  would  be  achievable. 


9 


Appendix  A.  Audit  Process 


Scope 


Work  Performed.  We  conducted  this  program  audit  from  October  2000 
through  February  2001  and  reviewed  documentation  dated  from  May  1995 
through  February  2001.  To  accomplish  the  audit  objective  we: 

•  Interviewed  officials  and  obtained  documentation  from  the  offices  of 
the  ASD(C3I),  the  Air  Force  Program  Management  Office,  the  Air 
Force  Pentagon  Communications  Agency,  cognizant  officials  and 
personnel  involved  in  the  acquisition  of  the  JPAS  information 
technology  investment,  and  contractor  personnel. 

•  Reviewed  available  documents  related  to  program  requirements, 
program  definition,  program  assessments  and  decision  reviews, 
periodic  reporting,  program  management  and  oversight,  and 
information  system  security. 

•  Evaluated  the  adequacy  of  management  controls  related  to  the 
acquisition  of  the  JPAS  information  technology  investment. 

DoD-Wide  Corporate  Level  Government  Performance  and  Results  Act 
Coverage.  In  response  to  the  Government  Performance  and  Results  Act,  the 
Secretary  of  Defense  annually  establishes  DoD-wide  corporate  level  goals, 
subordinate  performance  goals,  and  performance  measures.  This  report  pertains 
to  achievement  of  the  following  goal,  subordinate  performance  goal,  and 
performance  measure: 

FY  2001  DoD  Corporate  Level  Goal  2 :  Prepare  now  for  an  uncertain  future 
by  pursuing  a  focused  modernization  effort  that  maintains  U.S.  qualitative 
superiority  in  key  warfighting  capabilities.  Transform  the  force  by  exploiting 
the  Revolution  in  Military  Affairs,  and  reengineer  the  Department  to  achieve  a 
21st  century  infrastructure.  (Ol-DoD-2) 

FY  2001  Subordinate  Performance  Goal  2.5:  Improve  DoD  financial  and 
information  management.  (Ol-DoD-2.5) 

Performance  Measure  2.5.3:  Qualitative  Assessment  of  Reforming 
Information  Technology  Management.  (Ol-DoD-2.5.3) 
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DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  functional  area  objectives  and 
goals: 

Information  Technology  Management  Functional  Area. 

•  Objective.  Become  a  mission  partner. 

Goal.  Serve  mission  information  users  as  customers.  (ITM  1.2) 

•  Objective.  Provide  services  that  satisfy  customer  information  needs. 
Goal.  Build  architecture  and  performance  infrastructures.  (ITM  2.1) 
Goal.  Improve  information  technology  management  tools.  (ITM-2.4) 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  the  DoD.  This  report  provides  coverage 
of  the  Information  Security  and  DoD  Systems  Modernization  high-risk  areas. 

Methodology 


We  conducted  this  program  audit  in  accordance  with  auditing  standards  issued 
by  the  Comptroller  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD.  Accordingly,  we  included  tests  of  management  controls 
considered  necessary.  We  did  not  use  computer-processed  information  to 
perform  this  audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  and  outside  DoD.  Further  details  are  available  upon 
request. 

Management  Control  Program  Review 


DoD  Directive  5010.38,  “Management  Control  (MC)  Program,” 

August  26,  1996,  and  DoD  Instruction  5010.40,  “Management  Control  (MC) 
Program  Procedures,”  August  28,  1996,  require  DoD  organizations  to 
implement  a  comprehensive  system  of  management  controls  that  provides 
reasonable  assurance  that  programs  are  operating  as  intended  and  to  evaluate  the 
adequacy  of  the  controls. 
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Scope  of  the  Review  of  the  Management  Control  Program.  In  accordance 
with  DoD  Directive  5000.1,  DoD  Instruction  5000.2,  “Operation  of  the  Defense 
Acquisition  System,”  October  23,  2000,  and  DoD  Regulation  5000. 2-R, 
“Mandatory  Procedures  for  Major  Defense  Acquisition  Programs  (MDAPs)  and 
Major  Automated  Information  System  (MAIS)  Acquisition  Programs,” 

March  15,  1996  (subsequently  revised  on  January  4,  2001),  acquisition 
managers  are  to  apply  program  cost,  schedule,  and  performance  parameters  to 
control  objectives  for  implementing  DoD  Directive  5010.38  requirements. 
Accordingly,  we  limited  our  review  to  management  controls  directly  related  to 
the  acquisition  management  and  information  security  of  the  JPAS.  We  also 
reviewed  management’s  self-evaluation  of  management  controls  applicable  to 
the  acquisition  of  JPAS  information  technology. 

Adequacy  of  the  Management  Controls.  Management  controls  were 
inadequate  for  the  acquisition  of  the  JPAS.  Life-cycle  plans  were  not 
developed,  nor  were  program  baselines  determined  for  the  information 
technology  investment.  As  a  result,  an  internal  management  control  system  for 
monitoring  program  performance  and  progress  could  not  be  implemented.  Cost, 
schedule,  and  performance  deviations  could  not  be  identified  and  measurement 
indices  could  not  be  computed  for  projecting  results.  To  correct  its  management 
control  deficiencies,  the  Air  Force  agreed  to  develop  life-cycle  costs  and 
perform  independent  cost  and  economic  analyses.  Oversight  of  the  JPAS 
acquisition,  however,  remains  insufficient.  Implementation  of  our 
recommendation  for  increased  oversight  by  the  DoD  Chief  Information  Officer 
should  correct  this  weakness.  A  copy  of  the  report  will  be  sent  to  the  senior 
official  in  charge  of  management  controls  for  the  ASD(C3I). 

Adequacy  of  Management’s  Self-Evaluation.  Neither  the  ASD(C3I)  nor  the 
Air  Force  identified  JPAS  as  an  assessable  unit. 

Prior  Coverage 


During  the  last  5  years,  no  reports  addressing  the  JPAS  information  technology 
investment  have  been  issued. 
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Appendix  B.  DoD  Central  Adjudication  Facilities 


The  JPAS  central  database  will  support  the  following  nine  DoD  central 
adjudication  facilities: 

•  Department  of  the  Army  Central  Clearance  Facility, 

Fort  Meade,  Maryland 

•  Department  of  the  Navy  Central  Adjudication  Facility, 

Washington  Navy  Yard,  Washington,  District  of  Columbia 

•  Department  of  the  Air  Force  Central  Adjudication  Facility, 

Bolling  Air  Force  Base,  Washington,  District  of  Columbia 

•  Washington  Headquarters  Service  Central  Adjudication  Facility, 

Arlington,  Virginia 

•  Defense  Intelligence  Agency  Central  Adjudication  Division, 

Arlington,  Virginia 

•  Joint  Chiefs  of  Staff-Security/Central  Adjudication  Branch, 

Pentagon,  Washington,  District  of  Columbia 

•  National  Security  Agency  Central  Adjudication  Division, 

Fort  Meade,  Maryland 

•  Defense  Security  Service-Defense  Industrial  Security  Clearance 

Office  Central  Adjudication  Division, 

Columbus,  Ohio 

•  Defense  Office  of  Hearings  and  Appeals, 

Arlington,  Virginia,  and  Columbus,  Ohio 
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Appendix  C.  Acquisition  Guidance 


The  Office  of  Management  and  Budget  and  DoD  provide  managers  with 
guidance  for  acquiring  information  technology  investments  and  safeguarding 
information  assets. 

Office  of  Management  and  Budget 


Office  of  Management  and  Budget  Circular  A-130,  “Management  of  Federal 
Information  Resources,”  November  30,  2000,  implements  numerous  public  laws 
and  other  Office  of  Management  and  Budget  guidance  that  address  acquisition  of 
information  technology  investments  and  security  of  personal  information.  In 
accordance  with  the  Cohen-Clinger  Act  of  1996,  the  Circular  requires  that: 

•  Cost  benefit  analyses  be  prepared  for  each  system  throughout  its  life  cycle. 

•  Performance  measures  be  implemented  to  provide  timely  information 
regarding  the  progress  of  an  information  technology  program  in  terms  of 
cost  and  capability  to  meet  specified  requirements,  timeliness,  and 
quality. 

•  Major  information  systems  proceed  in  a  timely  fashion  toward  agreed- 
upon  milestones  in  an  information  system  life  cycle. 

•  Chief  information  officers  monitor  and  evaluate  the  performance  of 
information  technology  investments  through  the  capital  planning 
investment  control  process,  and  advise  the  agency  head  on  whether  to 
continue,  modify,  or  terminate  a  program  or  project. 

Further,  when  an  individual’s  right  to  privacy  must  be  protected,  the  Circular 
requires  management  controls  for  safeguarding  information  assets.  Those  controls 
include : 

•  the  assignment  of  a  person  who  is  responsible  for  ensuring  adequate 
system  security, 

•  the  development  of  security  plans  for  all  systems  containing  sensitive 
information, 

•  periodic  security  reviews  to  determine  the  effectiveness  of  controls,  and 

•  a  security  control  assessment  by  a  management  official  before  a  system 
processes  information. 
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DoD  Guidance 


DoD  Directive  5000.1.  DoD  Directive  5000.1,  “Defense  Acquisition,” 

March  15,  1996  (subsequently  revised  on  October  23,  2000),  establishes  a 
disciplined  life-cycle  management  approach  for  acquiring  quality  products.  The 
Directive  requires  rigorous  internal  management  control  systems  for  identifying 
deviations  from  approved  program  baselines. 

DoD  Directive  5200.28.  DoD  Directive  5200.28,  “Security  Requirements  for 
Automated  Information  Systems  (AISs),”  March  21,  1988,  provides  mandatory 
guidance  for  safeguarding  classified  information  and  information  that  might 
affect  the  privacy  of  DoD  personnel.  It  implements  security  safeguard 
provisions  of  Office  of  Management  and  Budget  Circular  A-130,  and  is  a 
reference  source  for  DoD  Instruction  5200.40,  “DoD  Information  Technology 
Security  Certification  and  Accreditation  Process  (DITSCAP),”  June  1,  1998, 
and  Air  Force  Systems  Security  Instruction  5024,  Volume  1,  “The  Certification 
and  Accreditation  (C&A)  Process,”  September  1,  1997. 

DoD  Instruction  5000.2.  DoD  Instruction  5000.2,  “Operation  of  the  Defense 
Acquisition  System,”  Change  1,  January  4,  2001,  establishes  a  general  approach 
for  managing  system  acquisitions  with  best  life-cycle  solutions  for  satisfying 
user  requirements.  The  Instruction  requires  chief  information  officers  to 
confirm  that  mission-critical  and  essential  information  systems  are  developed  in 
accordance  with  the  Clinger-Cohen  Act  of  1996  before  approvals  are  granted  for 
milestone  advancements. 

DoD  Regulation  5000.2-R.  Interim  DoD  Regulation  5000. 2-R,  “Mandatory 
Procedures  for  Major  Defense  Acquisition  Programs  (MDAPs)  and  Major 
Automated  Information  System  (MAIS)  Acquisition  Programs,”  January  4,  2001, 
establishes  life-cycle  procedures  for  managing  major  acquisition  programs  and  a 
model  for  other  system  acquisitions. 
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Appendix  D.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Chief,  Defense  Security  Service-Defense  Industrial  Security  Clearance  Office 
Central  Adjudication  Division 
Director,  Administration  and  Management 


Department  of  the  Army 

Commander,  Department  of  the  Army  Central  Clearance  Facility 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Director,  Department  of  the  Navy  Central  Adjudication  Facility 

Naval  Inspector  General 

Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Director,  Office  of  the  Administrative  Assistant,  Secretary  of  the  Air  Force 
Director,  Department  of  the  Air  Force  Central  Adjudication  Facility 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 

Director,  Defense  Finance  and  Accounting  Service 

Director,  Defense  Intelligence  Agency  Central  Adjudication  Division 

Inspector  General,  Defense  Intelligence  Agency 

Director,  Defense  Logistics  Agency 

Director,  Defense  Office  of  Hearings  and  Appeals 

Director,  National  Security  Agency 

Chief,  National  Security  Agency  Central  Adjudication  Division 
Inspector  General,  National  Security  Agency 
Chief,  Joint  Chiefs  of  Staff-Security/Central  Adjudication  Branch 
Chief,  Washington  Headquarters  Service  Central  Adjudication  Facility 
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Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 
Office  of  Information  and  Regulatory  Affairs 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency,  Financial  Management,  and 
Intergovernmental  Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology  and  Procurement  Policy,  Committee  on 
Government  Reform 
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Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  Comments 


OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 

6000  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-6000 


April  26, 2001 

MEMORANDUM  FOR  DEPUTY  DIRECTOR,  ACQUISITION  MANAGEMENT 
DIRECTORATE,  DODIG 

SUBJECT:  Audit  Report  on  Acquisition  Management  of  the  Joint  Personnel  Adjudication 
System  (Project  No.  D2001 AL-0012) 


This  is  in  response  to  your  memorandum  of  March  15, 2001,  which  forwarded  the  draft 
report  on  the  subject  report  for  review  and  comment.  While  this  office  and  the  Joint  Personnel 
Adjudication  System  (JPAS)  Program  Management  Office  welcomed  the  opportunity  to  meet 
with  your  auditors  on  this  project  and  discuss  the  management  of  JPAS,  we  had  concerns  with 
certain  observations  and  conclusions  in  the  report. 

JPAS  has  developed  and  implemented  a  life-cycle  acquisition  strategy  over  the  Future 
Years  Defense  Plan,  albeit  not  to  the  extent  mandated  by  statute.  This  will  be  corrected.  With 
respect  to  the  requirement  for  using  RDT&E  versus  O&M  funding  for  development  and 
deployment  of  JPAS,  we  have  found  that  even  our  Comptroller  colleagues  were  unaware  of  this 
requirement  and  we  were  not  advised  of  this  during  our  many  conversations  with  them.  While 
we  will  work  to  make  the  change  in  JPAS  development  funding  from  O&M  to  RDT&E,  due  to 
practical  realities  this  will  likely  not  occur  until  FY02.  Additionally,  while  we  initially  had  no 
opposition  to  moving  JPAS  funding  and  accounting  responsibilities  out  of  the  Air  Force,  it 
appears  that  this  may  not  be  desirable  or  achievable  in  the  near  future  without  adversely 
impacting  progress  on  JPAS.  While  we  also  agreed  to  update  the  JPAS  functional  economic 
analysis,  this  will  not  be  possible  until  funding  is  identified  for  this  initiative,  probably  not  until 
FY02. 

With  respect  to  the  single  recommendation  concerning  designating  JPAS  as  a  Major 
Information  Technology  Investment  (MITI),  due  to  the  significance  of  JPAS  to  DoD,  the  DoD 
CIO  will  designate  JPAS  as  an  Acquisition  Category  III  program.  The  DoD  CIO  will  be  the 
Milestone  Decision  Authority  and  provide  oversight  of  the  program.  The  initial  level  of 
oversight  will  be  determined  after  a  review  of  JPAS’  business  plan.  The  DoD  CIO  will  monitor 
JPAS’  progress  through  the  Program  Manager  submission  of  quarterly  Defense  Acquisition 
Executive  Summaries  reports  starting  with  the  Fourth  Quarter  FY  01  submission. 

We  appreciate  the  opportunity  to  comment  on  this  report.  If  you  have  any  questions 
please  contact  Mr.  Peter  Nelson,  703-697-3969. 


Richard  F.  Williams,  CPP 
Director  of  Security 
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Audit  Team  Members 


The  Acquisition  Management  Directorate,  Office  of  the  Assistant  Inspector  General  for 
Auditing,  DoD,  prepared  this  report.  Personnel  of  the  Office  of  the  Inspector  General, 
DoD,  who  contributed  to  the  report,  are  listed  below. 

Mary  L.  Ugone 
Charles  M.  Santoni 
David  M.  Wyte 
Donald  Stockton 
Steve  J.  Bressi 
Robert  R.  Johnson 
Walter  Bohinski 
Krista  S.  Gordon 


